nat in DNS packet

[suber]

Hello,

Can i nat IN the DNS packet the reply from the DNS server ?
DNS reply with public and i want private IP.

thx

Suber

[cciesec2006]

You must have learned this method from Cisco Pix/ASA called
"DNS doctoring". This feature is something I don't think is supported in
Checkpoint.

[mcnallym]

No it isn't supported. If you really need it then I would submit a feature request to Check Point through your reseller.

If they get enough then they may add it.

[johnxmcmanus]

Checkpoint have the following article which suggest it is supported, although I have not been able to get it working yet.


If anyone has got it working can you post some details of the configuration you used.

Regards
John
Solution ID: sk32145


Configuring overlapping address space and DNS
Product: VPN-1 Pro (VPN-1/FW-1)
Version: NGX
Last Modified: 18-Jun-2007

In the SmartCenter Server you need to change the $FWDIR/conf/objects_5_0.C fw_dns_xlation attribute from "false" to "true".

[mcnallym]

I have just had a look at that article and looking at it then it seems that it works as you are doing NAT on the gateway as you have an overlapping address space, and you are static nat the networks that overlap at each gateway. ie any traffic leaving the gateway A is NAT from 10.0.0.0/8 to 11.0.0.0/8

ie the DNS reponse is translated from 10.x.x.x to 11.x.x.x as opposed to 40.40.40.40 to 10.10.10.2 or whatever is internally.

I am not sure that is relevant to the original query.

I would say that original query is more that is accessing a public facing DNS Server to try and resolve internal IP addresses rather then having seperate public and private DNS Servers. ie mydomain.com is internal and externally used and is using a single DNS Server to resolve from internal net and the Internet.

A better solution and more secure for that is to have a DNS Server internally that responds with internal IP addresses and a seperate DNS Server that is accessed from the Internet to resolve the public IP for the domain.

That way your internal DNS Server is not accessed from the outside world.

Certainly that is the way that I would do it.

[johnxmcmanus]

The problem I am facing is establishing Actve Directory Trust between multiple windows AD forest.

One Central forest has global(unique) ip addresses within the infrastructure. The other 5 foreset have overlapping addresses. So for all domain controllers in these other forest we need to NAT their addresses between the boundary of the Central Forest.

since there are approx 25 multiple DNS records per domain controller and multiple domain controllers pre forest, It would be more efficent if the NAT Firewall would update the DNS request to aid in interforest communication (I can easily do this with a cisco router but checkpoint will be on the boundary).


The Best soultion for my scenario would be to get the checkpoint to do what it said on the tin.

Regards
John